remove session set of user. Once the passport user is found, request.user is the deserialized user, which was overriding the serialized user set during _logIn